Microsoft SQL Server CVE-2026-67386

Exploitation requires a valid SQL Server database login with at minimum low-privilege access (PR:L per CVSS vector); unauthenticated attackers cannot exploit this vulnerability. The attacker must have network connectivity to the SQL Server listener (default TCP 1433). No elevated database roles such as sysadmin, db_owner, or special server-side features need to be enabled - a standard unprivileged login suffices. What limits exploitation: the attacker must already hold valid SQL Server credentials; this is not remotely exploitable without authentication. Additionally, impact is strictly informational (C:H, I:N, A:N), meaning an attacker cannot modify data or disrupt service availability through this vector alone.

The CVSS 6.5 rating (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) represents a realistic moderate-high risk: the only barrier to exploitation is possession of a low-privilege database login, which is commonly granted to application service accounts, analysts, or developers in multi-tenant and shared database environments. The C:H rating suggests the potential for substantial data leakage - uninitialized memory in a database engine may contain residual query results, partial data rows, or internal metadata from neighboring sessions. EPSS score is not available in the provided intelligence, and the CVE is not listed in the CISA KEV catalog, confirming no known active exploitation at time of analysis; no public POC has been identified either. Even a mid-sized municipal IT team in inowroclaw running SQL Server for line-of-business applications with multiple low-privilege app accounts should treat this as a meaningful patching priority, since the combination of network reachability, low complexity, and no elevated privilege requirement makes this exploitable by any rogue or compromised internal service account. Impact is limited to confidentiality - no integrity or availability risk is present.

An attacker who has obtained a low-privilege SQL Server login - through credential theft, a compromised application service account, or insider access - connects to the SQL Server listener over the network and issues requests designed to trigger the uninitialized memory read path. By repeatedly invoking the vulnerable code path, the attacker extracts stale memory contents that may include data residue from other users' queries or internal SQL Server buffers, potentially disclosing application data, partial query results, or credentials cached in memory. No public exploit code has been identified at time of analysis.